29 ms·

What are the security downsides to using this for, for example, 2FA SMS? The cost of cloud providers in this space is neglible, but I'd still like to think abo

What are the security downsides to using this for, for example, 2FA SMS? The cost of cloud providers in this space is neglible, but I'd still like to think about this as an exercise.

ffritz 5y ago
Actually for Germany, the costs for sending an SMS with Twilio is 9 ct. If I’m not mistaken, that is 10x more than what it costs in the US.
- edoceo 5y ago
  Twilio and Plivo are sub-penny (USD$0.01) per message - for most of NA. International gets a bit more but in USA is cheap.
- ljf 5y ago
  Isn't that because in the US the receiver of the SMS also pays?
- kuschku 5y ago
  That’s actually relatively cheap, considering SMS prices used to be much higher than that until the EU enforced a hard limit of 10ct per SMS as maximum price.
  - ffritz 5y ago
    In what universe is 9 ct for a couple bytes over the wire cheap?
    - kuschku 5y ago
      In the context where, until recently, it was 25ct+ for the same 140 bytes.
mellavora 5y ago
Confirming the EU costs as circa 10c per SMS. Varies slightly by provider (twillio, AWS, ..), country, and perhaps exchange rate (if you pay in USD, billing may be fixed in EUR)
jqpabc123 5y ago
Volume/capacity/rate. Not exactly a security issue per se but ordinary SIM cards/phone numbers are intended for personal use and are limited in how many messages you can send per minute/hour/day. When your messages are blocked, your 2FA obviously fails.
toast0 5y ago
From a security point of view, if you're using anything before LTE?, the carrier verifies the SIM, but the SIM doesn't verify the network, which means your devices could get tricked into sending through a rogue network that could see your 2fa codes and destinations. Similarly, I don't remember when mobile network cryptography got good, but older networks are definitely eavesdroppable. You don't want your 2FA codes eavesdroppable beyond the minimum footprint for obvious security reasons; carriers visibility is unavoidable with SMS 2FA, but maybe there's a gain with a device you control vs an aggregator (and aggregators commonly use other aggregators for some of their routes), although you really can't know how a carrier delivers messages destined for other carriers. If you're going to do this, you need to do it as part of a system where you use many providers and monitor success. If the rate is high, it's almost certainly going to get blocked. But then, it may work better for some destinations than any commercial provider. Or it might continue to work when the commercial providers have outages, or the carriers do maintenance on their external connectors. Some of the SMS aggregators use regular SIMs to send some messages, or contract with others to do so, it's generally called a grey route. Usually with more specialized equipment and more SIMs, but same basic idea.

What are the security downsides to using this for, for example, 2FA SMS? The cost of cloud providers in this space is neglible, but I'd still like to think about this as an exercise.

ffritz 5y ago

Actually for Germany, the costs for sending an SMS with Twilio is 9 ct. If I’m not mistaken, that is 10x more than what it costs in the US.

edoceo 5y ago
Twilio and Plivo are sub-penny (USD$0.01) per message - for most of NA. International gets a bit more but in USA is cheap.
ljf 5y ago
Isn't that because in the US the receiver of the SMS also pays?
kuschku 5y ago
That’s actually relatively cheap, considering SMS prices used to be much higher than that until the EU enforced a hard limit of 10ct per SMS as maximum price.
- ffritz 5y ago
  In what universe is 9 ct for a couple bytes over the wire cheap?
  - kuschku 5y ago
    In the context where, until recently, it was 25ct+ for the same 140 bytes.

mellavora 5y ago

Confirming the EU costs as circa 10c per SMS. Varies slightly by provider (twillio, AWS, ..), country, and perhaps exchange rate (if you pay in USD, billing may be fixed in EUR)

jqpabc123 5y ago

Volume/capacity/rate. Not exactly a security issue per se but ordinary SIM cards/phone numbers are intended for personal use and are limited in how many messages you can send per minute/hour/day. When your messages are blocked, your 2FA obviously fails.

toast0 5y ago

From a security point of view, if you're using anything before LTE?, the carrier verifies the SIM, but the SIM doesn't verify the network, which means your devices could get tricked into sending through a rogue network that could see your 2fa codes and destinations. Similarly, I don't remember when mobile network cryptography got good, but older networks are definitely eavesdroppable. You don't want your 2FA codes eavesdroppable beyond the minimum footprint for obvious security reasons; carriers visibility is unavoidable with SMS 2FA, but maybe there's a gain with a device you control vs an aggregator (and aggregators commonly use other aggregators for some of their routes), although you really can't know how a carrier delivers messages destined for other carriers. If you're going to do this, you need to do it as part of a system where you use many providers and monitor success. If the rate is high, it's almost certainly going to get blocked. But then, it may work better for some destinations than any commercial provider. Or it might continue to work when the commercial providers have outages, or the carriers do maintenance on their external connectors. Some of the SMS aggregators use regular SIMs to send some messages, or contract with others to do so, it's generally called a grey route. Usually with more specialized equipment and more SIMs, but same basic idea.